@teincfood/core 0.9.12 → 0.9.15

package/dist/db/connection.js

@@ -19,6 +19,7 @@ export async function openSyncDatabase() {
     const driver = getSqliteDriver();
     initPromise = (async () => {
         await runMigrations(driver);
+        await recoverInFlightCommands(driver);
         dbInstance = driver;
         syncLogger.info("SQLite", "Database opened and migrated", {
             name: DB_NAME,
@@ -71,6 +72,30 @@ async function runMigrations(db) {
         await doMigrate();
     }
 }
+/**
+ * Crash recovery: a process kill between `markCommandInFlight` and the
+ * command's terminal update leaves rows stuck in `in_flight`. They are
+ * invisible to the outbox query (which selects pending only), so the order
+ * would silently never sync. Reset them to pending on open so the next replay
+ * picks them up. Idempotent and safe: a fresh process owns all in-flight work.
+ */
+async function recoverInFlightCommands(db) {
+    try {
+        const result = await db.runAsync("UPDATE commands SET status = 'pending', error = NULL, updated_at = ? WHERE status = 'in_flight';", new Date().toISOString());
+        const changes = result?.changes ?? 0;
+        if (changes > 0) {
+            syncLogger.warn("SQLite", "Recovered in-flight commands after restart", {
+                count: changes,
+            });
+        }
+    }
+    catch (error) {
+        // Never block DB open on recovery — replay/backoff still works.
+        syncLogger.error("SQLite", "in-flight recovery failed", {
+            error: String(error),
+        });
+    }
+}
 export async function closeSyncDatabase() {
     if (dbInstance) {
         if (dbInstance.closeAsync)

package/dist/db/operations.d.ts

@@ -8,7 +8,7 @@ export interface InsertCommandInput {
     status?: PersistedCommand["status"];
 }
 export declare function insertCommand(db: SQLiteDatabase, input: InsertCommandInput): Promise<PersistedCommand>;
-export declare function getPendingCommands(db: SQLiteDatabase, limit?: number): Promise<PersistedCommand[]>;
+export declare function getPendingCommands(db: SQLiteDatabase, limit?: number, includeFailed?: boolean): Promise<PersistedCommand[]>;
 export declare function updateCommandStatus(db: SQLiteDatabase, commandId: string, status: PersistedCommand["status"], error?: string, incrementRetry?: boolean): Promise<void>;
 export declare function markCommandInFlight(db: SQLiteDatabase, commandId: string): Promise<void>;
 export declare function deleteCommand(db: SQLiteDatabase, commandId: string): Promise<void>;

package/dist/db/operations.js

@@ -24,10 +24,15 @@ export async function insertCommand(db, input) {
     syncLogger.command(command, "queued");
     return rowToPersistedCommand(row);
 }
-export async function getPendingCommands(db, limit = 100) {
+export async function getPendingCommands(db, limit = 100, includeFailed = false) {
+    // `failed` rows are terminal (permanent rejection / retries exhausted) — they
+    // must NOT be re-fetched by the replay loop, or every failed command would be
+    // re-POSTed and re-toasted on each pass. Diagnostics opts in via
+    // includeFailed for the full outbox dump.
+    const statuses = includeFailed ? "('pending', 'failed')" : "('pending')";
     const rows = await db.getAllAsync(`
       SELECT * FROM commands
-      WHERE status IN ('pending', 'failed')
+      WHERE status IN ${statuses}
       ORDER BY created_at ASC
       LIMIT ?;
     `, limit);

package/dist/hooks/startup-readiness.hooks.d.ts

@@ -0,0 +1,24 @@
+/**
+ * React hook for startup readiness (seller POS/order surfaces).
+ *
+ * Runs one bounded catch-up on mount (and whenever the cloud becomes
+ * reachable), then exposes the local cache readiness so the app can block the
+ * POS with an explicit "preparing offline data" state instead of surprising
+ * the seller with a guard failure at order-tap time.
+ */
+import { type StartupReadiness } from "../sync/startup-readiness";
+export interface UseStartupReadinessOptions {
+    /** Bound the online catch-up attempt. Defaults to 15000ms. */
+    timeoutMs?: number;
+    /** Set false to skip automatic checking. */
+    enabled?: boolean;
+}
+export interface UseStartupReadinessResult {
+    businessId: string | undefined;
+    readiness: StartupReadiness | null;
+    /** True while the catch-up check is running (first load only). */
+    checking: boolean;
+    /** Re-run the readiness check on demand (e.g. a Retry button). */
+    recheck: () => Promise<void>;
+}
+export declare function useStartupReadiness(options?: UseStartupReadinessOptions): UseStartupReadinessResult;

package/dist/hooks/startup-readiness.hooks.js

@@ -0,0 +1,61 @@
+/**
+ * React hook for startup readiness (seller POS/order surfaces).
+ *
+ * Runs one bounded catch-up on mount (and whenever the cloud becomes
+ * reachable), then exposes the local cache readiness so the app can block the
+ * POS with an explicit "preparing offline data" state instead of surprising
+ * the seller with a guard failure at order-tap time.
+ */
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useSyncExternalStore } from "react";
+import { getActiveBusiness, subscribeBusiness } from "../adapters/business";
+import { getConnectivityState, subscribeConnectivity } from "../adapters/connectivity";
+import { ensureStartupReady, } from "../sync/startup-readiness";
+function useActiveBusinessId() {
+    const id = useSyncExternalStore(subscribeBusiness, () => getActiveBusiness()?.id ?? null, () => null);
+    return id ?? undefined;
+}
+function useCloudStatus() {
+    return useSyncExternalStore(subscribeConnectivity, () => getConnectivityState().isCloudReachable, () => "unknown");
+}
+export function useStartupReadiness(options = {}) {
+    const { timeoutMs, enabled = true } = options;
+    const businessId = useActiveBusinessId();
+    const cloudStatus = useCloudStatus();
+    const [readiness, setReadiness] = useState(null);
+    const [checking, setChecking] = useState(false);
+    const runRef = useRef(false);
+    const check = useCallback(async () => {
+        if (!businessId)
+            return;
+        if (runRef.current)
+            return;
+        runRef.current = true;
+        setChecking(true);
+        try {
+            const result = await ensureStartupReady(businessId, { timeoutMs });
+            setReadiness(result);
+        }
+        finally {
+            runRef.current = false;
+            setChecking(false);
+        }
+    }, [businessId, timeoutMs]);
+    // First check when a business is available.
+    useEffect(() => {
+        if (!enabled || !businessId)
+            return;
+        if (readiness)
+            return;
+        void check();
+    }, [enabled, businessId, readiness, check]);
+    // Re-check whenever cloud reachability flips to reachable (data may now sync).
+    useEffect(() => {
+        if (!enabled || !businessId)
+            return;
+        if (cloudStatus !== "reachable")
+            return;
+        void check();
+    }, [enabled, businessId, cloudStatus, check]);
+    return { businessId, readiness, checking, recheck: check };
+}

package/dist/index.d.ts

@@ -54,6 +54,8 @@ export { buildCommand } from "./sync/command-builder";
 export { generateLocalOrderNumber, generateLocalCalloutNumber, isLocalOrderNumber, generateOrderNumber, generateOrderNumberForBusiness, isOfflineOrderNumber, parseOrderNumber, resetCalloutForTests, } from "./sync/order-number";
 export { deviceLeaseService, getDeviceNumber, isOnlineOnly, ensureLease } from "./sync/device-lease.service";
 export { useDeviceLease, ensureDeviceLease } from "./sync/use-device-lease";
+export { getStartupReadiness, ensureStartupReady, REQUIRED_ORDER_KEYS, type StartupReadiness, } from "./sync/startup-readiness";
+export { useStartupReadiness, type UseStartupReadinessOptions, type UseStartupReadinessResult, } from "./hooks/startup-readiness.hooks";
 export * from "./utils/hlc";
 export * from "./reference/lww";
 export { orderSnapshotsService } from "./sync/order-snapshots.service";

package/dist/index.js

@@ -57,6 +57,8 @@ export { buildCommand } from "./sync/command-builder";
 export { generateLocalOrderNumber, generateLocalCalloutNumber, isLocalOrderNumber, generateOrderNumber, generateOrderNumberForBusiness, isOfflineOrderNumber, parseOrderNumber, resetCalloutForTests, } from "./sync/order-number";
 export { deviceLeaseService, getDeviceNumber, isOnlineOnly, ensureLease } from "./sync/device-lease.service";
 export { useDeviceLease, ensureDeviceLease } from "./sync/use-device-lease";
+export { getStartupReadiness, ensureStartupReady, REQUIRED_ORDER_KEYS, } from "./sync/startup-readiness";
+export { useStartupReadiness, } from "./hooks/startup-readiness.hooks";
 export * from "./utils/hlc";
 export * from "./reference/lww";
 export { orderSnapshotsService } from "./sync/order-snapshots.service";

package/dist/printer/receipt.js

@@ -441,6 +441,9 @@ export function generateEscpos(order, logoRasterB64) {
     push(LF);
     pushT(company.website + LF);
     pushT(`Powered by ${company.name}` + LF);
+    // Trailing space before the blade: feed past the print head so the cut
+    // never slices the last footer line.
+    push(ESC_FEED_3);
     push(ESC_FEED_3);
     push(GS_CUT_FULL);
     return parts.filter((p) => p != null).join("");

package/dist/sync/command-queue.service.d.ts

@@ -39,8 +39,13 @@ declare class CommandQueueService {
      */
     private absorbIfApplied;
     /**
-     * Replay all pending commands in order. Stops on the first failure to keep
-     * ordering consistent; the next replay will retry from the failed command.
+     * Replay pending commands in FIFO order with entity-aware skip-and-continue.
+     *
+     * Ordering is preserved per entity: a failing command defers only its own
+     * entity_id, so that order's later commands stay queued behind it, while
+     * independent entities keep syncing in the same pass. The pass stops only
+     * when nothing can make progress: no transport at all (REPLAY_NO_TRANSPORT)
+     * or TRANSPORT_FAILURE_BREAKER consecutive network/5xx failures.
      */
     replay(): Promise<void>;
     /**

package/dist/sync/command-queue.service.js

@@ -12,7 +12,7 @@ import { getSyncDatabase, openSyncDatabase } from "../db/connection";
 import { insertCommand, getPendingCommands, markCommandInFlight, updateCommandStatus, deleteCommand, insertEvent, } from "../db/operations";
 import { syncLogger } from "../utils/sync-logger";
 import { recordAttempt } from "../utils/attempt-stats";
-import { TransitionError, isReplayDeferred, TRANSITION_ERROR_CODES } from "./transition-errors";
+import { TransitionError, isReplayDeferred, isReplayNoTransport, TRANSITION_ERROR_CODES } from "./transition-errors";
 import { assertBusinessOpenForCreate } from "../utils/business-hours";
 import { extractApiErrorCode } from "../utils/error";
 import { generateEventId } from "../utils/uuid";
@@ -22,6 +22,13 @@ import { getConnectivityState, subscribeConnectivity } from "../adapters/connect
 import { canBusinessSync } from "./sync-guard";
 import { backoffDelayMs } from "./backoff";
 const MAX_RETRIES = 5;
+/**
+ * Stop a replay pass after this many consecutive transport-level failures
+ * (network/timeout/5xx) so a dead server is not hammered once per queued
+ * command. Any server response (2xx, permanent 4xx) or deferral resets the
+ * counter. The next trigger (connectivity/backoff) starts a fresh pass.
+ */
+const TRANSPORT_FAILURE_BREAKER = 3;
 /**
  * 4xx that deserve another chance: transient races and rate limits, never
  * permanent verdicts. Anything else 4xx (400 validation, 401 session,
@@ -294,10 +301,16 @@ class CommandQueueService {
             // the next trigger (do not mark, do not count). Must reset the
             // in_flight flag first — rows stuck in_flight are invisible to the
             // outbox query and would wedge the queue forever.
-            if (isReplayDeferred(error)) {
+            if (isReplayNoTransport(error)) {
                 await updateCommandStatus(db, command.command_id, "pending", "deferred:no-transport");
                 throw error;
             }
+            // Per-command backoff (retry window or retryable-4xx backoff): leave the
+            // row pending and rethrow so the pass defers just this entity.
+            if (isReplayDeferred(error)) {
+                await updateCommandStatus(db, command.command_id, "pending", "deferred:backoff");
+                throw error;
+            }
             const apiErr = error;
             const message = error instanceof Error ? error.message : String(error);
             // 409 ORDER_NUMBER_TAKEN is retryable once with new RRR (exact backend code, any envelope)
@@ -437,8 +450,13 @@ class CommandQueueService {
         return false;
     }
     /**
-     * Replay all pending commands in order. Stops on the first failure to keep
-     * ordering consistent; the next replay will retry from the failed command.
+     * Replay pending commands in FIFO order with entity-aware skip-and-continue.
+     *
+     * Ordering is preserved per entity: a failing command defers only its own
+     * entity_id, so that order's later commands stay queued behind it, while
+     * independent entities keep syncing in the same pass. The pass stops only
+     * when nothing can make progress: no transport at all (REPLAY_NO_TRANSPORT)
+     * or TRANSPORT_FAILURE_BREAKER consecutive network/5xx failures.
      */
     async replay() {
         if (!canBusinessSync())
@@ -469,21 +487,59 @@ class CommandQueueService {
             syncLogger.info("CommandQueueService", "Replaying commands", {
                 count: pending.length,
             });
+            // Entities deferred in THIS pass (backoff window or a transport failure):
+            // later commands for the same entity are skipped to preserve per-entity
+            // FIFO without blocking independent commands.
+            const deferredEntities = new Set();
+            let consecutiveTransportFailures = 0;
             for (const command of pending) {
+                const entity = command.entity_id;
+                if (entity && deferredEntities.has(entity)) {
+                    syncLogger.debug("CommandQueueService", "Skipping command for deferred entity", {
+                        command_id: command.command_id,
+                        entity_id: entity,
+                    });
+                    continue;
+                }
                 try {
                     await this.processCommand(command);
+                    consecutiveTransportFailures = 0;
                 }
                 catch (e) {
-                    const replayErr = e;
-                    const isNonRetryable = typeof replayErr?.status === "number" &&
-                        replayErr.status >= 400 &&
-                        replayErr.status < 500;
-                    if (isNonRetryable) {
-                        // Already marked permanent in processCommand — continue to next.
+                    // No transport at all: nothing in this pass can succeed — stop.
+                    if (isReplayNoTransport(e)) {
+                        syncLogger.info("CommandQueueService", "Replay stopped: no transport available", {
+                            command_id: command.command_id,
+                        });
+                        break;
+                    }
+                    // Per-command deferral (backoff window / retryable-4xx backoff):
+                    // defer this entity only and keep draining the rest.
+                    if (isReplayDeferred(e)) {
+                        if (entity)
+                            deferredEntities.add(entity);
+                        consecutiveTransportFailures = 0;
                         continue;
                     }
-                    // Network/5xx — stop to preserve ordering; retry later.
-                    break;
+                    const status = e?.status;
+                    const is4xx = typeof status === "number" && status >= 400 && status < 500;
+                    if (is4xx) {
+                        // Permanent/retryable-exhausted 4xx: processCommand already marked
+                        // the row failed (or absorbed it) — continue to the next command.
+                        consecutiveTransportFailures = 0;
+                        continue;
+                    }
+                    // Network/timeout/5xx: defer this entity, continue, but trip the
+                    // breaker if the transport looks dead so we stop hammering.
+                    if (entity)
+                        deferredEntities.add(entity);
+                    consecutiveTransportFailures += 1;
+                    if (consecutiveTransportFailures >= TRANSPORT_FAILURE_BREAKER) {
+                        syncLogger.warn("CommandQueueService", "Replay stopped: transport failure breaker tripped", {
+                            consecutiveTransportFailures,
+                        });
+                        break;
+                    }
                 }
             }
         }
@@ -520,7 +576,7 @@ class CommandQueueService {
     async debugDumpCommands(businessId) {
         try {
             const db = getSyncDatabase();
-            const rows = await getPendingCommands(db, Number.MAX_SAFE_INTEGER);
+            const rows = await getPendingCommands(db, Number.MAX_SAFE_INTEGER, true);
             return rows
                 .filter((c) => !businessId || c.business_id === businessId)
                 .map((c) => ({

package/dist/sync/engine.d.ts

@@ -48,7 +48,6 @@ export declare class SyncEngine {
      */
     publish(event: DomainEvent): void;
     private resolveStrategy;
-    private selectTransport;
     private broadcast;
 }
 export declare const syncEngine: SyncEngine;

package/dist/sync/engine.js

@@ -18,7 +18,7 @@ import { getConnectivityState } from "../adapters/connectivity";
 import { ApiError } from "../adapters/http";
 import { errorCodeOf } from "./transition-errors";
 import { syncLogger } from "../utils/sync-logger";
-import { CLOUD_COMMAND_TIMEOUT_MS } from "../utils/constants";
+import { CLOUD_COMMAND_TIMEOUT_MS, LAN_COMMAND_TIMEOUT_MS } from "../utils/constants";
 import { CAPABILITY_BY_COMMAND } from "../reference/capabilities";
 import { getReferenceData } from "../reference/operations";
 import { openSyncDatabase } from "../db/connection";
@@ -39,6 +39,17 @@ function withTimeout(promise, ms) {
         });
     });
 }
+/**
+ * Cash sales must never be refused for lack of entitlement proof: the POS
+ * domain defaults a missing method to cash, and only cash can be fulfilled
+ * without the backend. Anything else keeps the fail-closed guard.
+ */
+function isCashOrderCreate(command) {
+    if (command.command_type !== "order:create")
+        return false;
+    const method = command.payload?.pos_payment_method;
+    return method === undefined || method === "cash";
+}
 export class SyncEngine {
     constructor(options) {
         this.eventSubscribers = [];
@@ -80,89 +91,131 @@ export class SyncEngine {
                 // otherwise fail open
             }
         }
-        // Entitlement guard (fail-closed, offline-first): subscription-gated
-        // commands need cached proof before routing. Backend 402 backstops.
+        // Entitlement guard (offline-first): subscription-gated commands need
+        // cached proof before routing — EXCEPT cash order:create, which always
+        // queues so the terminal never refuses a sale offline. The backend 402
+        // remains the backstop at replay; the queued event is flagged so the
+        // pending list can badge it until the server confirms.
+        let queueDespiteEntitlement = false;
         try {
             await assertEntitledForCommand(command.business_id, command.command_type);
         }
         catch (e) {
             if (e instanceof TransitionError &&
                 e.code === TRANSITION_ERROR_CODES.SUBSCRIPTION_REQUIRED) {
-                throw e;
+                if (isCashOrderCreate(command)) {
+                    queueDespiteEntitlement = true;
+                    syncLogger.warn("SyncEngine", "queueing cash order without entitlement proof", {
+                        command_id: command.command_id,
+                        business_id: command.business_id,
+                    });
+                }
+                else {
+                    throw e;
+                }
+            }
+            else {
+                // Guard infra failure (no DB yet, corrupt cache) must not brick the
+                // terminal — backend remains the authority. Log and continue.
+                syncLogger.warn("SyncEngine", "entitlement guard skipped", {
+                    error: e instanceof Error ? e.message : String(e),
+                });
             }
-            // Guard infra failure (no DB yet, corrupt cache) must not brick the
-            // terminal — backend remains the authority. Log and continue.
-            syncLogger.warn("SyncEngine", "entitlement guard skipped", {
-                error: e instanceof Error ? e.message : String(e),
-            });
         }
-        let strategy = this.resolveStrategy(command);
+        const initialStrategy = this.resolveStrategy(command);
         const { isCloudReachable, isOnline } = getConnectivityState();
         syncLogger.info("SyncEngine", "Command strategy resolved", {
             command_id: command.command_id,
             command_type: command.command_type,
-            strategy,
+            strategy: initialStrategy,
             isCloudReachable,
             isOnline,
             cloud_available: restTransport.isAvailable(),
             lan_available: localNodeTransport.isAvailable(),
         });
-        if (strategy === "queue") {
-            // Replays must never re-enqueue-then-delete (the command would eat
-            // itself without executing). If no real transport is available, leave
-            // the row untouched for a later trigger.
-            if (opts?.forReplay) {
-                throw new TransitionError(TRANSITION_ERROR_CODES.REPLAY_DEFERRED, "No transport available, keeping command queued");
-            }
-            const event = await commandQueueService.enqueue(command);
-            this.broadcast(event);
-            // Menu writes need a visible local effect while queued: patch the
-            // durable reference cache optimistically and fan out
-            // reference_data.changed so reconciliation applies it locally and
-            // relays it to LAN peers (replay re-applies idempotently; the backend
-            // owns versions on cloud convergence).
-            if (command.command_type.startsWith("menu:")) {
-                try {
-                    const { applyMenuCommandLocal } = await import("../reference/menu-apply");
-                    const { keys } = await applyMenuCommandLocal(command.business_id, command);
-                    if (keys.length) {
-                        const { REFERENCE_CHANGED_EVENT_TYPE } = await import("../reference/events");
-                        const { generateEventId } = await import("../utils/uuid");
-                        this.broadcast({
-                            event_id: generateEventId(),
-                            event_type: REFERENCE_CHANGED_EVENT_TYPE,
-                            event_version: "1.0",
-                            entity_id: command.business_id,
-                            user_id: command.user_id,
-                            device_id: command.device_id,
-                            payload: { business_id: command.business_id, keys },
-                            timestamp: new Date().toISOString(),
-                        });
-                    }
+        // Ordered attempts for THIS execution only. Every await below is capped,
+        // so the UI can never hang: a stale "reachable" belief may send the
+        // first attempt to a dead cloud, but it is tried ONCE (2.5s cap) and
+        // never re-entered — the command downgrades to LAN, then the outbox.
+        const attempts = initialStrategy === "cloud"
+            ? [
+                "cloud",
+                ...(localNodeTransport.isAvailable() ? ["local_node"] : []),
+                "queue",
+            ]
+            : initialStrategy === "local_node"
+                ? ["local_node", "queue"]
+                : ["queue"];
+        let lastError = null;
+        for (const attempt of attempts) {
+            if (attempt === "queue") {
+                // Replays must never re-enqueue-then-delete (the command would eat
+                // itself without executing). If no real transport is available, leave
+                // the row untouched for a later trigger. Distinct code so the outbox
+                // stops the whole replay pass (nothing can succeed) rather than
+                // skipping just this entity and hammering the rest.
+                if (opts?.forReplay) {
+                    throw new TransitionError(TRANSITION_ERROR_CODES.REPLAY_NO_TRANSPORT, "No transport available, keeping command queued");
                 }
-                catch (e) {
-                    syncLogger.debug("SyncEngine", "queued menu optimistic apply failed", { err: String(e) });
+                const event = await commandQueueService.enqueue(command);
+                if (queueDespiteEntitlement) {
+                    event.payload = {
+                        ...event.payload,
+                        entitlement_unverified: true,
+                    };
                 }
+                this.broadcast(event);
+                // Menu writes need a visible local effect while queued: patch the
+                // durable reference cache optimistically and fan out
+                // reference_data.changed so reconciliation applies it locally and
+                // relays it to LAN peers (replay re-applies idempotently; the backend
+                // owns versions on cloud convergence).
+                if (command.command_type.startsWith("menu:")) {
+                    try {
+                        const { applyMenuCommandLocal } = await import("../reference/menu-apply");
+                        const { keys } = await applyMenuCommandLocal(command.business_id, command);
+                        if (keys.length) {
+                            const { REFERENCE_CHANGED_EVENT_TYPE } = await import("../reference/events");
+                            const { generateEventId } = await import("../utils/uuid");
+                            this.broadcast({
+                                event_id: generateEventId(),
+                                event_type: REFERENCE_CHANGED_EVENT_TYPE,
+                                event_version: "1.0",
+                                entity_id: command.business_id,
+                                user_id: command.user_id,
+                                device_id: command.device_id,
+                                payload: { business_id: command.business_id, keys },
+                                timestamp: new Date().toISOString(),
+                            });
+                        }
+                    }
+                    catch (e) {
+                        syncLogger.debug("SyncEngine", "queued menu optimistic apply failed", { err: String(e) });
+                    }
+                }
+                return [event];
             }
-            return [event];
-        }
-        if (strategy === "cloud") {
+            const transport = attempt === "cloud" ? restTransport : localNodeTransport;
+            const cap = attempt === "cloud" ? CLOUD_COMMAND_TIMEOUT_MS : LAN_COMMAND_TIMEOUT_MS;
             try {
-                const events = await withTimeout(restTransport.execute(command), CLOUD_COMMAND_TIMEOUT_MS);
+                const events = await withTimeout(transport.execute(command), cap);
                 for (const event of events) {
                     this.broadcast(event);
                 }
                 syncLogger.command(command, "completed", {
                     event_count: events.length,
+                    transport: transport.name,
                 });
-                // Cloud just worked: replay anything queued during the outage.
-                // Flag-neutral: only the health probe writes isCloudReachable — a
-                // single success here is not its decision to make either.
-                this.replayQueuedCommands().catch((error) => {
-                    syncLogger.error("SyncEngine", "Replay after cloud success failed", {
-                        error: String(error),
+                if (attempt === "cloud") {
+                    // Cloud just worked: replay anything queued during the outage.
+                    // Flag-neutral: only the health probe writes isCloudReachable — a
+                    // single success here is not its decision to make either.
+                    this.replayQueuedCommands().catch((error) => {
+                        syncLogger.error("SyncEngine", "Replay after cloud success failed", {
+                            error: String(error),
+                        });
                     });
-                });
+                }
                 return events;
             }
             catch (error) {
@@ -190,60 +243,32 @@ export class SyncEngine {
                     ? error.status
                     : undefined;
                 if (rejectionStatus !== undefined && rejectionStatus >= 400 && rejectionStatus < 500) {
-                    syncLogger.warn("SyncEngine", "Cloud command rejected by server", {
+                    syncLogger.warn("SyncEngine", "Command rejected by server", {
                         command_type: command.command_type,
                         command_id: command.command_id,
+                        transport: transport.name,
                         status: rejectionStatus,
                         code,
                         message: error instanceof Error ? error.message : String(error),
                     });
                     throw error;
                 }
-                // Cloud is slow or unreachable: fall back to the Local Node or the
-                // outbox so the terminal stays responsive. Flag-neutral: only the
+                // Timeout or network error: downgrade to the next attempt (LAN, then
+                // outbox) so the terminal stays responsive. Flag-neutral: only the
                 // health probe writes isCloudReachable — a failed request is never
                 // evidence the cloud is down (it may be a logic rejection without a
                 // numeric status, e.g. TransitionError). The probe detects real
                 // outages; queued work replays when it reports recovery.
-                syncLogger.warn("SyncEngine", "Cloud command timed out, falling back", {
+                syncLogger.warn("SyncEngine", `${transport.name} attempt failed, downgrading`, {
                     command_type: command.command_type,
-                    error: String(error),
-                });
-                strategy = this.resolveStrategy(command);
-                if (strategy === "queue") {
-                    // Replays must never re-enqueue-then-delete (the command would eat
-                    // itself without executing). If no real transport is available, leave
-                    // the row untouched for a later trigger.
-                    if (opts?.forReplay) {
-                        throw new TransitionError(TRANSITION_ERROR_CODES.REPLAY_DEFERRED, "No transport available, keeping command queued");
-                    }
-                    const event = await commandQueueService.enqueue(command);
-                    this.broadcast(event);
-                    return [event];
-                }
-                syncLogger.info("SyncEngine", "Cloud timed out, using LAN fallback", {
                     command_id: command.command_id,
-                    command_type: command.command_type,
-                    strategy,
+                    error: String(error),
                 });
+                lastError = error;
             }
         }
-        const transport = this.selectTransport(command, strategy);
-        syncLogger.info("SyncEngine", "Executing via transport", {
-            command_id: command.command_id,
-            command_type: command.command_type,
-            strategy,
-            transport: transport.name,
-        });
-        const events = await transport.execute(command);
-        for (const event of events) {
-            this.broadcast(event);
-        }
-        syncLogger.command(command, "completed", {
-            event_count: events.length,
-            transport: transport.name,
-        });
-        return events;
+        // Unreachable: attempts always ends with "queue", which returns.
+        throw lastError ?? new Error("SyncEngine: no transport attempt succeeded");
     }
     /**
      * Trigger replay of queued commands when connectivity returns.
@@ -296,19 +321,6 @@ export class SyncEngine {
         }
         return "cloud";
     }
-    selectTransport(_command, strategy) {
-        if (strategy === "local_node" && localNodeTransport.isAvailable()) {
-            return localNodeTransport;
-        }
-        if (strategy === "cloud" && restTransport.isAvailable()) {
-            return restTransport;
-        }
-        const transport = this.transports.find((t) => t.isAvailable()) ?? this.transports[0];
-        if (!transport) {
-            throw new Error("SyncEngine: no transports configured");
-        }
-        return transport;
-    }
     broadcast(event) {
         syncLogger.event(event, "broadcast");
         this.eventSubscribers.forEach((handler) => handler(event));

package/dist/sync/full-sync.d.ts

@@ -1,6 +1,14 @@
 /**
- * Full sync: push → pull → push.
- * Push first so local edits (already HLC-bumped) reach server before pull
- * overwrites them; then pull merges; final drain pushes any remainder.
+ * Full sync: reference → push → pull → push.
+ *
+ * Reference (menu/hours/tax/capabilities) is pulled FIRST and non-blockingly:
+ * every phase is independently swallowed, so a reference failure never
+ * prevents queued orders from flushing. Getting reference in before the order
+ * push means newly-launched terminals can satisfy order-creation prerequisites
+ * (hour/tax/capability guards) in the same cycle.
+ *
+ * Orders still push before the order pull, so local edits (already HLC-bumped)
+ * reach the server before the pull merge could overwrite them. The final
+ * drain flushes anything newly queued or retried after the pull.
  */
 export declare function performFullSync(businessId?: string): Promise<void>;

package/dist/sync/full-sync.js

@@ -1,7 +1,15 @@
 /**
- * Full sync: push → pull → push.
- * Push first so local edits (already HLC-bumped) reach server before pull
- * overwrites them; then pull merges; final drain pushes any remainder.
+ * Full sync: reference → push → pull → push.
+ *
+ * Reference (menu/hours/tax/capabilities) is pulled FIRST and non-blockingly:
+ * every phase is independently swallowed, so a reference failure never
+ * prevents queued orders from flushing. Getting reference in before the order
+ * push means newly-launched terminals can satisfy order-creation prerequisites
+ * (hour/tax/capability guards) in the same cycle.
+ *
+ * Orders still push before the order pull, so local edits (already HLC-bumped)
+ * reach the server before the pull merge could overwrite them. The final
+ * drain flushes anything newly queued or retried after the pull.
  */
 import { getConnectivityState } from "../adapters/connectivity";
 import { getActiveBusiness } from "../adapters/business";
@@ -26,28 +34,30 @@ export async function performFullSync(businessId) {
     }
     const p = (async () => {
         try {
-            syncLogger.info("FullSync", "Starting push→pull→push", { businessId: bid });
-            // 1. Push pending FIFO first — HLC-bumped local edits outrank stale server
+            syncLogger.info("FullSync", "Starting reference→push→pull→push", { businessId: bid });
+            // 1. Reference first (non-blocking): menu/hours/tax/caps so order
+            //    creation prerequisites are present before we flush orders.
             try {
-                await drainPending(bid);
+                await referenceSyncService.sync({ businessId: bid });
             }
             catch (e) {
-                syncLogger.warn("FullSync", "drainPending(pre) failed", { err: String(e) });
+                syncLogger.warn("FullSync", "reference sync failed", { err: String(e) });
             }
-            // 2. Pull remote orders (HLC-guarded) and reference (LWW merge)
+            // 2. Push pending FIFO — HLC-bumped local edits outrank stale server
             try {
-                await pullRemoteOrders(bid);
+                await drainPending(bid);
             }
             catch (e) {
-                syncLogger.warn("FullSync", "pullRemoteOrders failed", { err: String(e) });
+                syncLogger.warn("FullSync", "drainPending(pre) failed", { err: String(e) });
             }
+            // 3. Pull remote orders (HLC-guarded)
             try {
-                await referenceSyncService.sync({ businessId: bid });
+                await pullRemoteOrders(bid);
             }
             catch (e) {
-                syncLogger.warn("FullSync", "reference sync failed", { err: String(e) });
+                syncLogger.warn("FullSync", "pullRemoteOrders failed", { err: String(e) });
             }
-            // 3. Final drain — anything newly queued or retried after pull
+            // 4. Final drain — anything newly queued or retried after pull
             try {
                 await drainPending(bid);
             }

package/dist/sync/startup-readiness.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Startup readiness for the POS/order surfaces.
+ *
+ * The offline-first guards intentionally fail closed (HOURS_NOT_SYNCED,
+ * SUBSCRIPTION_REQUIRED, "no device leased"), which is correct — but if the
+ * required reference data was never loaded, those guards fire at order-tap
+ * time as a surprise. This module lets the app discover the same conditions at
+ * launch: it evaluates the local cache (no network) and, when online, performs
+ * one bounded catch-up sync so a freshly-launched terminal can satisfy the
+ * guards before the seller starts taking orders.
+ *
+ * Seller-only. Fleet/rider surfaces are fully online and never gate here.
+ */
+import type { ReferenceDataKey } from "../reference/types";
+/**
+ * Reference keys required before the app presents itself as ready to take
+ * orders: menu to sell, taxes to price, hours to open, profile/capabilities
+ * for routing + guards, and the signed entitlement proof for gated commands.
+ */
+export declare const REQUIRED_ORDER_KEYS: readonly ReferenceDataKey[];
+export interface StartupReadiness {
+    /** True when every required key is cached and a device number is leased. */
+    ready: boolean;
+    /** Required keys with no cached payload. */
+    missingKeys: ReferenceDataKey[];
+    /** True when no DD-RRR-CCC device number is available (needs one online lease). */
+    needsLease: boolean;
+    /**
+     * True when an entitlement envelope is absent or does not evaluate as
+     * entitled. Informational: cash orders still queue offline, so this does not
+     * by itself block readiness.
+     */
+    entitlementUnverified: boolean;
+}
+/** Evaluate the local cache only (no network). */
+export declare function getStartupReadiness(businessId: string): Promise<StartupReadiness>;
+/**
+ * One bounded catch-up attempt, then evaluate the cache. When offline (or the
+ * cloud is unreachable) this performs no network work and simply reports what
+ * is cached. Never throws.
+ */
+export declare function ensureStartupReady(businessId: string, opts?: {
+    timeoutMs?: number;
+}): Promise<StartupReadiness>;

package/dist/sync/startup-readiness.js

@@ -0,0 +1,115 @@
+/**
+ * Startup readiness for the POS/order surfaces.
+ *
+ * The offline-first guards intentionally fail closed (HOURS_NOT_SYNCED,
+ * SUBSCRIPTION_REQUIRED, "no device leased"), which is correct — but if the
+ * required reference data was never loaded, those guards fire at order-tap
+ * time as a surprise. This module lets the app discover the same conditions at
+ * launch: it evaluates the local cache (no network) and, when online, performs
+ * one bounded catch-up sync so a freshly-launched terminal can satisfy the
+ * guards before the seller starts taking orders.
+ *
+ * Seller-only. Fleet/rider surfaces are fully online and never gate here.
+ */
+import { openSyncDatabase } from "../db/connection";
+import { getReferenceData } from "../reference/operations";
+import { referenceSyncService } from "../reference/service";
+import { evaluateBusinessEntitlements } from "../reference/entitlement-guard";
+import { ensureLease } from "./device-lease.service";
+import { getConnectivityState } from "../adapters/connectivity";
+import { syncLogger } from "../utils/sync-logger";
+/**
+ * Reference keys required before the app presents itself as ready to take
+ * orders: menu to sell, taxes to price, hours to open, profile/capabilities
+ * for routing + guards, and the signed entitlement proof for gated commands.
+ */
+export const REQUIRED_ORDER_KEYS = [
+    "subscription:entitlements",
+    "capabilities",
+    "menu:categories",
+    "menu:items",
+    "tax-rules",
+    "business:profile",
+    "operating-hours",
+];
+/** Evaluate the local cache only (no network). */
+export async function getStartupReadiness(businessId) {
+    const db = await openSyncDatabase();
+    const records = await Promise.all(REQUIRED_ORDER_KEYS.map(async (key) => ({
+        key,
+        rec: await getReferenceData(db, businessId, key),
+    })));
+    const missingKeys = records
+        .filter((r) => !r.rec || r.rec.payload == null)
+        .map((r) => r.key);
+    // ensureLease() hydrates the sync KV from async KV and leases online when
+    // possible; offline with no cache it returns null (caller blocks POS).
+    let deviceNumber = null;
+    try {
+        deviceNumber = await ensureLease(businessId);
+    }
+    catch (e) {
+        syncLogger.warn("StartupReadiness", "lease check failed", { err: String(e) });
+    }
+    const needsLease = !deviceNumber;
+    let entitlementUnverified = missingKeys.includes("subscription:entitlements");
+    if (!entitlementUnverified) {
+        try {
+            const { evaluation } = await evaluateBusinessEntitlements(businessId);
+            entitlementUnverified = !evaluation.entitled;
+        }
+        catch {
+            entitlementUnverified = true;
+        }
+    }
+    return {
+        ready: missingKeys.length === 0 && !needsLease,
+        missingKeys,
+        needsLease,
+        entitlementUnverified,
+    };
+}
+/**
+ * One bounded catch-up attempt, then evaluate the cache. When offline (or the
+ * cloud is unreachable) this performs no network work and simply reports what
+ * is cached. Never throws.
+ */
+export async function ensureStartupReady(businessId, opts) {
+    const timeoutMs = opts?.timeoutMs ?? 15000;
+    const { isOnline, isCloudReachable } = getConnectivityState();
+    if (isOnline && isCloudReachable !== "unreachable") {
+        const catchUp = (async () => {
+            try {
+                await referenceSyncService.sync({ businessId, keys: [...REQUIRED_ORDER_KEYS] });
+            }
+            catch (e) {
+                syncLogger.warn("StartupReadiness", "reference catch-up failed", { err: String(e) });
+            }
+            try {
+                await ensureLease(businessId);
+            }
+            catch (e) {
+                syncLogger.warn("StartupReadiness", "lease catch-up failed", { err: String(e) });
+            }
+        })();
+        await raceWithTimeout(catchUp, timeoutMs);
+    }
+    return getStartupReadiness(businessId);
+}
+/** Resolve after either the promise settles or the timeout elapses. */
+async function raceWithTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(resolve, ms);
+    });
+    try {
+        await Promise.race([
+            promise.then(() => undefined, () => undefined),
+            timeout,
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/dist/sync/transition-errors.d.ts

@@ -18,6 +18,13 @@ export declare const TRANSITION_ERROR_CODES: {
     readonly FORBIDDEN: "FORBIDDEN";
     readonly SUBSCRIPTION_REQUIRED: "SUBSCRIPTION_REQUIRED";
     readonly REPLAY_DEFERRED: "REPLAY_DEFERRED";
+    /**
+     * Replay found no usable transport at all (cloud + LAN both unavailable).
+     * Distinct from REPLAY_DEFERRED (per-command backoff/retryable-4xx) so the
+     * outbox can stop the whole pass instead of skipping just this entity:
+     * nothing can succeed until a transport returns.
+     */
+    readonly REPLAY_NO_TRANSPORT: "REPLAY_NO_TRANSPORT";
     readonly MISSING_RIDER: "MISSING_RIDER";
     readonly NO_DELIVERY: "NO_DELIVERY";
 };
@@ -30,3 +37,4 @@ export declare class TransitionError extends Error {
 export declare function errorCodeOf(error: unknown): string | undefined;
 export declare function isFinalGuardRejection(error: unknown): boolean;
 export declare function isReplayDeferred(error: unknown): boolean;
+export declare function isReplayNoTransport(error: unknown): boolean;

package/dist/sync/transition-errors.js

@@ -18,6 +18,13 @@ export const TRANSITION_ERROR_CODES = {
     FORBIDDEN: "FORBIDDEN",
     SUBSCRIPTION_REQUIRED: "SUBSCRIPTION_REQUIRED",
     REPLAY_DEFERRED: "REPLAY_DEFERRED",
+    /**
+     * Replay found no usable transport at all (cloud + LAN both unavailable).
+     * Distinct from REPLAY_DEFERRED (per-command backoff/retryable-4xx) so the
+     * outbox can stop the whole pass instead of skipping just this entity:
+     * nothing can succeed until a transport returns.
+     */
+    REPLAY_NO_TRANSPORT: "REPLAY_NO_TRANSPORT",
     MISSING_RIDER: "MISSING_RIDER",
     NO_DELIVERY: "NO_DELIVERY",
 };
@@ -59,3 +66,6 @@ export function isFinalGuardRejection(error) {
 export function isReplayDeferred(error) {
     return errorCodeOf(error) === TRANSITION_ERROR_CODES.REPLAY_DEFERRED;
 }
+export function isReplayNoTransport(error) {
+    return errorCodeOf(error) === TRANSITION_ERROR_CODES.REPLAY_NO_TRANSPORT;
+}

package/dist/test-helpers/memory-driver.js

@@ -95,6 +95,18 @@ export function createMemoryDriver() {
                     tables.commands.push(row);
                 return { lastInsertRowId: row.id, changes: 1 };
             }
+            // crash recovery: in_flight -> pending on open
+            if (s.includes("UPDATE commands SET status = 'pending'") && s.includes("WHERE status = 'in_flight'")) {
+                let changes = 0;
+                for (const row of tables.commands) {
+                    if (row.status === "in_flight") {
+                        row.status = "pending";
+                        row.error = null;
+                        changes += 1;
+                    }
+                }
+                return { lastInsertRowId: 0, changes };
+            }
             // commands update status (4- or 5-placeholder variants — always take the
             // LAST arg as command_id; older code assumed 5).
             if (s.includes("UPDATE commands SET status = ?")) {
@@ -365,7 +377,12 @@ export function createMemoryDriver() {
             }
             if (s.includes("SELECT * FROM commands") && s.includes("WHERE status IN")) {
                 const limit = args[args.length - 1];
-                let rows = tables.commands.filter((r) => r.status === "pending" || r.status === "failed").sort((a, b) => (a.created_at < b.created_at ? -1 : 1));
+                // Mirror production: `failed` is terminal and only returned when the
+                // caller opts in (includeFailed -> SQL contains 'failed').
+                const includeFailed = s.includes("'failed'");
+                let rows = tables.commands
+                    .filter((r) => r.status === "pending" || (includeFailed && r.status === "failed"))
+                    .sort((a, b) => (a.created_at < b.created_at ? -1 : 1));
                 if (limit)
                     rows = rows.slice(0, limit);
                 return rows;

package/dist/utils/constants.d.ts

@@ -49,6 +49,12 @@ export declare const DEFAULT_PAGE_SIZE = 20;
  * Keeps the terminal responsive (fast) even when the internet is slow.
  */
 export declare const CLOUD_COMMAND_TIMEOUT_MS = 2500;
+/**
+ * Max time the Sync Engine waits for a Local Node command before falling
+ * back to the offline outbox. LAN discovery can stall on a dead peer —
+ * this cap keeps every engine await bounded so the UI can never hang.
+ */
+export declare const LAN_COMMAND_TIMEOUT_MS = 5000;
 export declare const appVersion = "0.7.3";
 /** Default config bundle for createTeincCore overrides */
 export declare const DEFAULTS: {
@@ -84,4 +90,5 @@ export declare const DEFAULTS: {
     readonly OTP_RESEND_DELAY_SECONDS: 60;
     readonly DEFAULT_PAGE_SIZE: 20;
     readonly CLOUD_COMMAND_TIMEOUT_MS: 2500;
+    readonly LAN_COMMAND_TIMEOUT_MS: 5000;
 };

package/dist/utils/constants.js

@@ -77,6 +77,12 @@ export const DEFAULT_PAGE_SIZE = 20;
  * Keeps the terminal responsive (fast) even when the internet is slow.
  */
 export const CLOUD_COMMAND_TIMEOUT_MS = 2500;
+/**
+ * Max time the Sync Engine waits for a Local Node command before falling
+ * back to the offline outbox. LAN discovery can stall on a dead peer —
+ * this cap keeps every engine await bounded so the UI can never hang.
+ */
+export const LAN_COMMAND_TIMEOUT_MS = 5000;
 // Expo version removed; expose static version for now
 export const appVersion = APP_VERSION;
 /** Default config bundle for createTeincCore overrides */
@@ -92,4 +98,5 @@ export const DEFAULTS = {
     OTP_RESEND_DELAY_SECONDS,
     DEFAULT_PAGE_SIZE,
     CLOUD_COMMAND_TIMEOUT_MS,
+    LAN_COMMAND_TIMEOUT_MS,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teincfood/core",
-  "version": "0.9.12",
+  "version": "0.9.15",
   "description": "TeincFood shared offline-first core — types, sync engine, local DB, reference data, and repositories for mobile + desktop",
   "type": "module",
   "main": "dist/index.js",